So I've changed (again) how new users are able to authenticate, because it's clear that several new users over the last month weren't able to get in. I am hoping the spam gets blocked, but if the spam starts to come back, I'll have to change the process yet again. Fingers crossed.